mc_geo, mc_currency) — those stay on so prices display correctly. Analytics + marketing cookies are off until you accept. See the cookie policy for the full list. Which cookies Mercentia sets, what each one is for, and how long it lasts. Every entry below is taken from the code that sets it.
Last updated · August 2026
Mercentia's own cookies are strictly necessary: they keep you signed in, stop other sites submitting forms as you, and remember a preference you set. We set no advertising cookies. No third-party analytics or marketing script loads on this site unless you opt in on the banner, and you can change that at any time.
| Cookie | Where | Purpose | Lifetime | Category |
|---|---|---|---|---|
sf_csrf | Dashboard, storefront, checkout | Cross-site request forgery token. The value is submitted back with each write and must match, which is what stops another site acting as you. | 24 hours | Strictly necessary |
better-auth.session_token | Dashboard | Keeps you signed in. Carries the __Secure- prefix where the deployment serves HTTPS end to end. | Session, extended on use | Strictly necessary |
mc_staff | Support console | Marks a Mercentia support session, separately from a merchant login. | Session | Strictly necessary |
mc_shop_as | Support console | Which store a support session is currently acting in. Every action taken this way is written to that store's audit log. | Session | Strictly necessary |
sf_unlocked | Storefront | Remembers that you entered the password for a store that is not public yet. | Session | Strictly necessary |
sf_preview | Storefront | Holds the theme being previewed, so a merchant sees a draft and shoppers do not. | Session | Strictly necessary |
mc_geo | mercentia.com | Detected country, which sets the default currency and regional copy. | 7 days | Strictly necessary |
mc_currency | mercentia.com | A currency you picked yourself on the pricing or calculator page. | 7 days | Strictly necessary |
mc_consent | mercentia.com | Your answer to the cookie banner. Without it we would ask on every page. | 12 months | Strictly necessary |
A shopper's basket is held in the browser's local storage, not in a cookie, so it is never sent to a server on every request. It stays on the device until the shopper clears it or it expires. Consent rules cover any storage on a device, not only cookies, and this is the strictly-necessary kind: without it a basket would empty on every page change.
The dashboard likewise keeps interface preferences locally — which columns you last chose, whether you dismissed a checklist. None of it is personal data and none of it leaves your browser.
A store you buy from runs on Mercentia but is operated by that merchant. The strictly necessary cookies above apply there. Anything beyond them — a Meta pixel, a GA4 tag, a TikTok tag — is configured by the merchant and disclosed in their own policies, and their consent banner controls whether it loads. Mercentia's default is to load nothing analytical or advertising-related until the shopper has consented.
Use the Cookie settings link in the footer of this site to change your answer at any time; the new choice takes effect immediately. You can also clear cookies in your browser, though clearing the strictly necessary ones will sign you out and cause the banner to ask again.
Questions: [email protected]. Fuller detail on data handling is in the privacy policy.